For non same-origin resources, we zero-out the duration and description fields. I don't think that's enough. duration and description are both optional - the mere presence of a server-timing metric with a particular name (eg. Server-Timing: cache-hit) is enough to communicate boolean information. I propose that we completely ignore all server timing headers for resources that do not pass the "timing allow check" algorithm.
(see: https://w3c.github.io/server-timing/#cross-origin-resources)
For non same-origin resources, we zero-out the
duration
anddescription
fields. I don't think that's enough.duration
anddescription
are both optional - the mere presence of a server-timing metric with a particular name (eg.Server-Timing: cache-hit
) is enough to communicate boolean information. I propose that we completely ignore all server timing headers for resources that do not pass the "timing allow check" algorithm.cc @igrigorik @yoavweiss